Canadian Lawyer

"The Criminal Code and all federal legislation need to be modernized quickly in order to keep pace with the ubiquitous nature of electronics. Either Parliament or the courts will have to step in." FRANK ADDARIO order paper when the 2011 election was called, C-12 is primarily designed (according to an Industry Canada back- grounder) of PIPEDA in an effort to protect and empower consumers and "enable effec- tive investigations by law enforcement and security agencies." Among other things, the changes to sharpen the legal teeth would make it mandatory for busi- nesses to report "material breaches of security safeguards" to a privacy com- missioner and to notify individuals if it determines the sensitivity of the person- al information involved in the breach is such that, if misused, would put those individuals at "real risk of significant harm," which includes everything from bodily harm and humiliation to loss of property or employment. Though businesses already have a protection group, thinks C-12 will do little to bolster consumer confidence about the safeguarding of their per- sonal information in a fast-paced world where electronics are ubiquitous. "Data breaches affect consumer con- request and without a warrant, and to preserve information. According to Andrea Slane, a lawyer civic duty to report crimes and evi- dence of offences to police (a manda- tory obligation for Internet service pro- viders in regards to child pornography since last March, when Bill C-22 was passed), the proposed legislation does not require businesses to turn over evi- dence without a warrant or production order, thereby preserving the current voluntary standard for them to report crimes and/or co-operate with police in cases where they have been victims of cybercrime or suffered a security breach or hacking. The lack of incentive and the pro- posed scope of discretion for com- panies to report and disclose are the most problematic provisions for many observers of bill C-12, which one legal wag has already dubbed the "anti-pri- vacy privacy bill. sumer protection, the legal counsel for the Public Interest Advocacy Centre, an Ottawa-based, non-profit consumer " In terms of con- fidence (but) in bill C-12, a breach remains in the eye of businesses," says John Lawford. He co-authored a report issued by the PIAC in January that recommended companies be required to report breaches to the federal pri- vacy commissioner, who should also be granted the power (which the privacy commissioner argued unsuccessfully for in public hearings on C-12) to both assess the level of "significant harm" involved and order companies to con- tact individuals if the need to do so is determined. For Lawford, companies today have myriad methods and manners to moni- tor and collect personal data and to build profiles about people when they interface with the Internet, either with their permission or without. ability will just keep accelerating [and] cross-referencing as e-commerce con- tinues to grow and develop, ford. "Voluntary reporting is a nice idea, but it's probably pretty weak in helping a company decide whether or not " says Law- report or disclose a breach that could compromise its future or reputation." Consumer protection however pales to in comparison to the legal debates and Charter-based court challenges that C-12 and bill C-30, a broader piece of cybercrime-fighting, Criminal Code- altering legislation that was introduced in the House of Commons in February, are expected to generate in regards to privacy law. Bill C-30 will notably make it mandatory for ISPs to provide cus- tomer names and addresses to police on and associate professor with the Fac- ulty of Social Science and Humanities at the University of Ontario Institute of Technology, businesses been victims of cybercrime, such as the Sony PlayStation Network, which was paralyzed for weeks by a massive data breach late last year, are notoriously reluctant to report such crimes for fear of repercussions from investors and/or customers. "Even if [C-12] becomes law, busi- that have nesses will continue to weigh the vari- ous factors that could tip the balance of civic duty toward disclosure, "That She adds that voluntary reporting could become even trickier for businesses in cases where employees or customers were found to be using its Internet services and/or its hardware to commit cybercrimes. That's why she believes that the scope of discretion for private entities proposed in bill C-12, together with a growing body of appellate-level case law that focuses on the proper application of s. 8 of the Charter of Rights and Freedoms, which protects against unreasonable search and sei- zure, will make for some impressive legal fireworks. "I think it's a no-brainer that someone somewhere will mount a s. 8 challenge, " says Slane. Lawyer. Frank Addario agrees. He is the law- " Slane tells Canadian yer for Richard Cole, a Sudbury, Ont., high school teacher who was charged after nude photos of a Grade 10 student were found on a laptop issued to him by his regional school board — photos that were ruled inadmissible by the Ontario Court of Appeal a year ago on the princi- ple, which the Supreme Court will begin www.CANADIAN Lawyermag.com M AY 2012 45

• Cover